# Safari Technology Preview 20 Release Notes Preview the latest web technology updates including: Visual Viewport, Touch Bar, JavaScript, Web API, Security, CSS, Pointer Lock, Web Inspector, WebCrypto API, and bug fixes. ## Overview [Safari Technology Preview](https://webkit.org/blog/6017/introducing-safari-technology-preview/) Release 20 is now [available for download](https://webkit.org/downloads/) for macOS Sierra. If you already have Safari Technology Preview installed, you can update from the Mac App Store’s Updates tab. This release covers WebKit revisions [209238-209803](https://trac.webkit.org/log/?stop_rev=209238&rev=209803&limit=999). ### Visual Viewport - Enabled the new “visual viewports” model for how `position: fixed` and `position: sticky` elements are positioned during pinch zooming and while zoomed in ([r209409](https://trac.webkit.org/changeset/209409)) ### Touch Bar - Prevented emoji buttons from displaying in the Touch Bar for password inputs ([r209626](https://trac.webkit.org/changeset/209626)) ### JavaScript - Enabled Shared Array Buffers ([r209568](https://trac.webkit.org/changeset/209568)) - Added a syntax error to report an unexpected token when async is followed by identifier in contexts where an async arrow function cannot occur ([r209350](https://trac.webkit.org/changeset/209350)) ### Web API - Added `Document.onvisibilitychange` event handler attribute ([r209750](https://trac.webkit.org/changeset/209750)) - Added reflected `nonce` attribute to the HTML Link element ([r209644](https://trac.webkit.org/changeset/209644)) - Added support for the deprecated dictionary constructors of `DOMPointReadOnly` and `DOMPoint` ([r209677](https://trac.webkit.org/changeset/209677)) - Fixed an issue where Custom Elements from a different document are not customized when created with `innerHTML` ([r209610](https://trac.webkit.org/changeset/209610)) - Fixed an issue causing animations followed by a transition to not always fire the `transitionend` event ([r209675](https://trac.webkit.org/changeset/209675)) - Prevented `document.webkitFullscreenElement` and `document.webkitCurrentFullScreenElement` from exposing a node inside a shadow tree ([r209628](https://trac.webkit.org/changeset/209628)) ### Security - Changed to require preflight for non-standard CORS-safelisted request headers `Accept`, `Accept-Language`, and `Content-Language` ([r209261](https://trac.webkit.org/changeset/209261), [r209510](https://trac.webkit.org/changeset/209510)) - Implemented Strict Mixed Content Checking; `block-all-mixed-content` directive ([r209577](https://trac.webkit.org/changeset/209577)) - Content Security Policy: Taught preload scanner how to preload `